Merchant API Key

Overview

A merchant API key is a secret credential that identifies and authenticates a merchant application when it calls protected payment-provider endpoints. Merchant API Key is an API credential bound to a merchant account and environment; its exact permissions and lifecycle differ from general or payout-specific credentials. Embedding it in browser code, mobile applications, public repositories, support tickets, or logs exposes the merchant. Teams need inventory, access logs, rotation, revocation, incident response, and safe redaction. Using one key across many systems also makes attribution and rotation difficult. A compromise response for Merchant API Key should support rapid revocation, replacement, affected-client identification, and review of prior use. For Merchant API Key, secrets and tokens should remain outside browser bundles, URLs, ordinary logs, and unprotected configuration.

Secure use of Merchant API Key keeps secrets outside client code and logs, applies least privilege, prevents replay where needed, monitors anomalies, and separates authentication from authorization. The key is issued to a merchant account or integration and sent through the provider’s required authentication mechanism. Keys should stay in server-side secret storage, use the narrowest available scope, and be separated by environment and application. It can authorize payment creation, information retrieval, history access, or other merchant-scoped operations depending on configured permissions. Callback authenticity should use its documented mechanism rather than assuming the API key alone protects inbound events. The Merchant API Key recovery process should restore access without bypassing the original identity and authorization controls.

The production contract for Merchant API Key should state the supported principals, credentials, keys, scopes, claims, requests, verification results, and revocation state, required and optional fields, types and units, validation rules, state preconditions, version, permissions, limits, errors, and compatibility guarantees.